[SHIRO-324] HashedCredentialsMatcher getCredentials() bug

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 1.1.0
• Component/s: Authentication (log-in), Cryptography & Hashing
• Environment: irrelevant
• Assignee: Unassigned
• Reporter: an wolf
• Created: 27/Sep/11 09:20
• Updated: 28/Sep/11 07:24
• Resolved: 28/Sep/11 07:24

Description

// isStoredCredentialsHexEncoded() always returns true, no matter if I store a hex or a base64 password or credential. Hex is Base16. Authentication fails if I store Base64 and don't move it to Hex before here with an IllegalArgumentException because Hex.decode(...) doesn't recognize but the 0..9 and a..f I think
//account.credentials were a char[] or String, so
//we need to do text decoding first:
if (isStoredCredentialsHexEncoded())

{ storedBytes = Hex.decode(storedBytes); }

else

{ storedBytes = Base64.decode(storedBytes); }

...
from my ini:

1. password hashing specification
   sha256Matcher = org.apache.shiro.authc.credential.HashedCredentialsMatcher
   sha256Matcher.hashAlgorithmName=SHA-256